CVE-2026-102784

Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request...

CVE-2026-102783

The Joomla Extension - balbooa.com - Gridbox (versions

CVE-2026-102783 Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0

Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is...